T1547.009 — Shortcut Modification

Tactics: Persistence, Privilege Escalation · Platforms: Windows

Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process. Adversaries may…

Sub-technique of Boot or Logon Autostart Execution (T1547).

Sigma detection rules (1)

T1547.009 Boot or Logon Autostart Execution: Shortcut Modification

title: "T1547.009 Boot or Logon Autostart Execution: Shortcut Modification"
id: f3d4b716-867e-45ea-b047-d964e861725f
description: 'Detects creation or modification of a Windows shortcut (.lnk) file within a Startup folder or the Desktop, consistent with an adversary planting or altering a shortcut to execute a program at system boot or user logon. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: TargetPathRegex, TimeWindow, UserContextScope, ZoneIdentifierThreshold.'
references:
  - https://attack.mitre.org/techniques/T1547/009
author: Shahrukh Khan
date: 2026-01-22
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1547.009

logsource:
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '11'
    TargetFilename|endswith: '.lnk'
  selection_path:
    TargetFilename|contains:
      - '\Microsoft\Windows\Start Menu\Programs\Startup\'
      - '\Desktop\'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_path and not filter_system_account

falsepositives:
  - Legitimate software installers placing a Startup or Desktop shortcut as part of normal setup; System and service accounts are excluded via filter_system_account; tune further with installer/publisher allowlists if noise remains.

level: medium

Related sub-techniques

Explore